SourceCodester Garage Management System createUser.php access control

Vulnerability

SourceCodester Garage Management System 1.0 contains a critical improper access control vulnerability in the /php_action/createUser.php endpoint. The script does not verify the user's authentication or session before processing a POST request, allowing anyone to create a new user account without any prior authentication. The affected version is Garage Management System 1.0 [1].

Exploitation

An unauthenticated attacker can send a crafted HTTP POST request to /php_action/createUser.php with a multipart/form-data payload containing fields such as userName, upassword, and uemail. No session token or authentication header is required. The exploit has been publicly disclosed and includes a proof-of-concept demonstrating that an attacker can add a new user (e.g., 123@qq.com with password admin@123) and then log in with those credentials [1].

Impact

Successful exploitation grants the attacker a valid user account on the system, potentially with administrative privileges as the endpoint does not restrict the role of the created user. The attacker can then access the application's backend, manipulate data, and perform any action allowed to that user role, leading to complete compromise of the garage management system [1].

Mitigation

As of the publication date (2022-07-29), no official patch or fixed version has been released by the vendor. Users should restrict network access to the createUser.php endpoint, implement proper authentication and session checks, or consider disabling the endpoint if not required. The vendor's site provides the software source code [1], so manual code review and patching are advised.